2.0 Analysis 2.1 Crew Training Petroleum tankers are specialized vessels and special technical skills and knowledge are required to operate them safely. The competence of tanker crews is a critical factor for safe and efficient operations. Traditionally, tanker crews acquired the necessary skills and competence during years spent at sea, preferably on a variety of vessels, but the quality of such experience can vary considerably between ships and from one company to another. The majority of the crew members on the PETROLAB had gained tanker experience solely on board the PETROLAB, which resulted in unsafe tank washing/slop transfer practices and procedures being developed on board and passed on to new crew members. The officers and crew had not received formal petroleum tanker training and none of them recognized the dangers inherent in the ship's accepted tanker work practices and procedures. Tanker safety courses enhance awareness of safe operational practices. The value of such training is recognized by IMO, and is contained in the STCW, which states in part: 1 Officers and ratings assigned specific duties and responsibilities related to cargo or cargo equipment on tankers shall have completed an approved shore-based fire-fighting course . . . and shall have completed: (.1) at least three months of approved seagoing service on tankers in order to acquire adequate knowledge of safe operational practices; or (.2) an approved tanker familiarization course . . . . 2 Masters, chief engineer officers, chief mates, second engineer officers and any person with immediate responsibility for loading, discharging and care in transit or handling of cargo shall, in addition to meeting the requirements of sub-paragraphs 1.1 or 1.2 , have: (.1) experience appropriate to their duties on the type of tanker on which they serve; and (.2) completed an approved specialized training programme which at least covers the subjects set out in section A-V/1 of the STCW Code that are appropriate to their duties on the oil tanker, chemical tanker or liquefied gas tanker on which they serve.[11] Had the owner, officers, or crew taken a petroleum tanker safety course, they may have recognized the dangers inherent in their tank washing procedures. Only the officers on board the PETROLAB had taken MED courses and received instruction on fighting shipboard fires. No regular emergency drills were held on the PETROLAB; therefore, the uncertificated crew members had only a limited possibility of acquiring the confidence and skills required to successfully fight a fire on board the ship. During the vessel's annual inspection, TC Marine Safety did not assess or determine the crew's ability to deal with emergencies on board ship as no boat and fire drill was carried out. 2.2 Management Oversight The key to good safety management is commitment from the top. Although the master is in overall command, management has the ultimate responsibility for setting policies, procedures, and operating instructions for the safe operation of a vessel. The owner of the PETROLAB had not established formal policies or procedures, particularly in the areas of cargo handling and tank washing. As a result, the crew did not have the guidance required for them to perform their duties safely. The owner often sailed with the vessel and was assisting with tank washing operations at the time of the explosion, but he lacked experience (on other tankers) and had no formal petroleum tanker safety training. Therefore, he could not, and did not, provide effective oversight to ensure the vessel's safe operation. 2.3 Chain of Command Although the owner did not interfere with navigational decisions made by the master, his presence aboard--and his reliance on the first mate--disrupted the chain of command on the vessel. The weak relationship (and conflict) between the master and first mate resulted in a lack of communication. In an economic climate where seagoing jobs are scarce, the master was reluctant to implement changes to the work responsibilities and unsafe procedures which had become accepted as normal by the owner and crew. There had been no resolution of this conflict at the time of the explosion. The first mate was working with the owner who was not qualified to conduct or direct petroleum tanker cargo operations. 2.4 Explosive Environment and Sources of Ignition When a flammable cloud of petroleum vapour is ignited, flames spread quickly through the mixture and a rapid expansion of gas occurs, resulting in a local pressure rise. In an open space, the expanding gases can disperse easily; however, in an enclosed space such as the 'tween-deck of the PETROLAB, the expanding gases were contained. The pressure continued to build up until it was released through openings and by the partial structural failure of the vessel. The explosion on the PETROLAB had enough force to severely distort the deck house structure, throw the owner over the side, knock down the mate and deckhand, and jam the engine-room escape door in the open position against the adjacent bulkhead. The fact that the flames exiting the 'tween-deck escape hatch were a deep red indicates that the vapour concentration in the 'tween-deck was rich (between 5 and 8 percent of vapour in the air). For a petroleum explosion to occur, three elements must be present: vapour, oxygen, and a source of ignition. For petroleum vapour to ignite, the amount of vapour in the air must be between strictly defined limits known as the lower explosive limit (LEL) and the upper explosive limit (UEL). The LEL and UEL range for gasoline is between 1 and 8 percent of vapour in the air. Below the LEL, the mixture is too lean and above the UEL it is too rich to ignite (see Appendix C). When gasoline and water mixtures being pumped from the COTs were allowed to free-fall through the 'tween-deck into the cofferdam during tank washing operations, vapour concentrations in excess of the LEL were created. Since the exhaust fans for the cofferdam and 'tween-deck space were not in use, gasoline vapours filled the cofferdam and 'tween-deck area, and the unsecured escape door (on the port side of the forward engine-room bulkhead leading into the cofferdam) would have allowed gasoline vapours to enter the engine-room. Although the exact source of ignition was not determined, several possible sources were present at the time of the explosion: Static electrical accumulation and discharge in the cofferdam or 'tween-deck.The conditions for static accumulation and discharge were present in the cofferdam and 'tween-deck. The spray of gasoline into the 'tween-deck and cofferdam provided both the vapour concentration and potential static electrical ignition source necessary for an explosion to occur. A spark from the Honda pump being used to transfer slops from the COTs to the cofferdam.Although no flames were reported around the pump at the time of the explosion, the pump was not equipped with an exhaust spark arrester and was operating in an area where gasoline fumes were emanating from the pump house door, 'tween-deck escape hatch and COTs. The non-intrinsically safe equipment in the engine-room. Much of the electrical equipment in the engine-room was not intrinsically safe and several possible sources of sparks or open flame, such as the boiler and running port generator were present in the engine-room. It is unknown why the chief engineer entered the engine-room when he did. He may have intended to pump the engine-room bilges into the cofferdam (for later disposal ashore) by means of the small non-standard submersible bilge pump. To do this, he may have opened the escape door to the cofferdam. Because the explosion occurred shortly after he entered the engine-room, such a transfer may have been made earlier (laboratory analysis of slop samples from both the cofferdam and the engine-room bilges show similar properties). The discharge hose from this pump was found leading toward the escape door after the explosion, but it is unknown when it was so deployed. The oil-fired domestic hot water boiler raised the temperature of the engine-room and accommodation. Therefore, it was often shut down and used only when hot water was required. It is known that the second engineer had intended to take a shower, and the boiler's main power switch was in the closed (energized) position; however, there is no clear indication as to whether the boiler was running at the time of the explosion or if the chief engineer had started or intended to start it. In summary, the conditions existed for a static discharge in the accumulated gasoline vapours in the cofferdam and 'tween-deck area, but as the chief engineer's activities in the engine-room are unknown, an ignition source from within the engine-room cannot be ruled out. 2.5 Local Firefighting Immediately after the explosion the second mate put out several small deck fires with a portable fire extinguisher; however, in the ensuing two to three hours after the explosion no effort was made by the ship's crew or the shore-based firefighters to fight the fire which, at that point, was limited to the 'tween-deck area. Although the PETROLAB was equipped with firefighting appliances as required by TC Marine Safety, there is no requirement for an emergency fire pump or emergency generator for a vessel under 45.7 metres, even if the vessel is engaged in carrying hazardous petroleum cargoes. The ship's Scott air pack bottles were empty, having been used during tank-washing operations and, with no ship's power, no emergency fire pump, and little training or leadership, the vessel's crew was left with no firefighting options. The first shore-based volunteer firefighters arrived shortly after the explosion. The master requested assistance in fighting the fire; however, the local firefighters were reluctant to fight the fire without foam, as they were under the mistaken impression that water could not be applied to an oil tanker fire. Although the wharf at St. Barbe served both oil tankers and passenger vessels on a regular basis, none of the local fire departments responding to the fire had training in shipboard firefighting. Medium expansion foam arrived with the Port au Choix fire department approximately one hour after the explosion, but was not applied to the fire which, at that point, was still limited to the area inside the vessel's 'tween-deck. The terminal operator, Ultramar, had a contingency plan in place for a fire at the tank farm; however, the terminal supervisor had not been given formal training in firefighting. The contingency plan relied on the local fire department which was not equipped with foam to fight petroleum fires, and did not refer to shipboard fires. By flushing the pipelines on the dock with water, the Ultramar employees helped prevent the spread of the fire to the tank farm and prevented pollution. The fire on board the vessel was left to burn out of control, and it eventually spread to the creosote-impregnated pilings under the dock. Once the piles caught fire, the concrete deck hampered the efforts of the firefighters and of the CCG vessels to reach the seat of the fire under the dock. The SIR WILFRED GRENFELL attempted to use her winches to dismantle the dock, with little success. Early intervention by the ship's crew and local fire departments using water and, when it arrived, foam, would probably have brought the fire under control before it had a chance to spread to the wharf. 2.6 Condition of the Vessel's Cargo-handling Equipment The condition of cargo pumps and piping systems is important for the safe operation of all oil tankers. Besides being used to discharge cargo, a tanker's pumping system may be used in damage and stability control situations resulting from flooding, and in cargo transfer operations to mitigate pollution resulting from accidents. As such, cargo-pumping systems on oil tankers are analogous to bilge-pumping systems on other vessels. The vessel's original vacuum tank-stripping equipment had been inoperable for at least 10 years and was considered too deteriorated to repair and return to service. It had therefore been blanked off. The alternative means of stripping tanks used by the first mate and condoned by the current owner was intrinsically unsafe--particularly the pumping of tank-washing slops into the cofferdam by means of a pump that the manufacturer's operating manual specifically warned was unsuitable for the task. 2.7 Oily Water Separator Exemption An oily water separator enables treated water from the bilges to be pumped directly overboard. As the BSI had granted an exemption to the vessel, the PETROLAB was not required to have an oily water separator. One effect of this exemption was that an alternative, unsafe system to pump out the engine-room bilges had developed aboard the vessel. A non-intrinsically safe, 12-volt, small yacht-type submersible bilge pump was used to transfer engine-room bilge slops to the cofferdam. Its discharge hose was passed through the open engine-room escape door. 2.8 Engine-room Escape Door On board the PETROLAB, the after cofferdam was contiguous with the 'tween-deck (pump room) above, being covered only by open mesh deck gratings. It was unorthodox to have installed a door, which, among other uses, could have been used to escape from an engine-room fire, particularly as the door accessed a space which often contained petroleum vapours. To prevent the movement of vapours between the two spaces, the engine-room escape door leading to the cofferdam should have been kept closed and secured at all times. Post-occurrence inspection of the door indicated that it was not secured at the time of the explosion. Therefore, the open door would have allowed the passage of gasoline vapours from the cofferdam into the engine-room. Additionally, if the source of the explosion was within the cofferdam and 'tween-deck area, the open door would have provided a path for the explosion flame front to enter the engine-room. Given the relatively small size of the engine-room and the location of the door, the door's benefit as an escape route was minimal. On the day of the explosion, not only did it not provide an escape route, it enabled the passage of gasoline vapours (or of a flame front) from the cofferdam into the engine-room, which caused the chief engineer's fatal injuries. 2.9 Use of the Government Wharf by Passenger Ferries The PETROLAB and the passenger ferry NORTHERN PRINCESS were both alongside the dock at St. Barbe for a total of about 90 to 135 minutes on the day of the explosion. Passengers were embarked and disembarked from the ferry while the PETROLAB was conducting cargo and other hazardous operations. The precautions taken to physically separate the ferry passengers from the tanker's inherently hazardous cargo operations were minimal, and the travelling public was unnecessarily put at risk. 2.10 Transport Canada Inspections Seaworthiness is the sufficiency of a vessel in materials, construction, equipment and crew for the trade or service in which it is employed.[12] Shipowners must therefore ensure that all of these conditions are satisfied. The vessel must also comply with TC construction, equipment, and crewing standards. 2.10.1 Construction The vessel's arrangement of an enclosed 'tween-deck and contiguous after cofferdam was unorthodox. While this did not necessarily mean that the vessel was unsafe, a level of safety equivalent to that of conventional petroleum tankers would have to be present for acceptance into Canadian registry. Canadian regulations required a second engine-room escape route. In 1983 the vessel's previous owner submitted plans to TC showing an escape door through the forward engine-room bulkhead. These plans showed the engine-room contiguous with the 'tween-deck space, which was effectively a pump room. TC approved the plans as submitted. 2.10.2 Bilge-pumping Arrangements In 1993 the owner applied for a COPP certificate. In his application for an exemption from the requirement to equip the vessel with an engine-room oily water separator, the owner indicated that the vessel would store all bilge slops on board in the dedicated slop tanks. This exemption was granted by the BSI, but no follow-up inspection was undertaken to verify the bilge-pumping arrangements. TC did not know that an unsafe engine-room bilge-pumping system, which required that the engine-room escape door be left open, had been jury-rigged. The after cofferdam was not on the list of hull spaces to be inspected, and had not been formally inspected since the vessel came under Canadian flag in 1983. 2.10.3 Cargo-pumping Arrangements As Canadian regulations do not require that the vessel's cargo-pumping system be inspected and as the vessel was out of class, the unserviceable condition of the vessel's vacuum tank-stripping system was not determined by either TC or a classification society. The vessel had been inspected by TC under Canadian regulations and issued the appropriate certificates, but the unnoticed poor condition of the cargo-pumping system compromised her seaworthiness. The condition of the pumping equipment had not been assessed since the vessel came under Canadian registry in 1983. 2.10.4 Emergency Equipment Under Canadian regulations, a vessel the size of the PETROLAB is not required to be equipped with an emergency generator or an emergency fire pump, irrespective of her use as a petroleum tanker. Therefore, no shipboard resource (particularly the 'tween-deck foam system) was available to fight the fire after the ship's service generator stopped as a result of the explosion. 2.10.5 Assessment of the Crew's Competence The TC inspector who carried out the vessel's annual inspection in May 1997 was not trained in petroleum tanker safety and did not hold a petroleum tanker endorsement. He did not require the crew to perform a boat and fire drill nor did he inspect the crew's certificates. Therefore, the crew's ability to safely operate the vessel and to respond to emergency situations (such as a shipboard fire) was not adequately assessed. 3.0 Conclusions 3.1 Findings 1. The vessel was inspected by TC Marine Safety in May 1997, but no inspection of the cargo-pumping or engine-room bilge-pumping systems was carried out. Under current Canadian regulations, there is no requirement for oil tanker cargo pumps and pumping systems to be inspected by TC. The vessel's tank-stripping system had been inoperable for at least 10 years, and the cargo piping system had been modified to discharge directly into the cofferdam instead of the dedicated slop tanks. The after cofferdam was not on the list of hull spaces to be formally inspected by TC as part of the continuous hull survey regime. The Board of Steamship Inspection (BSI) had granted the vessel an exemption from the requirement to have an engine-room oily water separator, based on the understanding that all bilges would be pumped to the dedicated slop tanks and then ashore. The vessel was not equipped with an emergency generator or an emergency fire pump nor was such equipment required under Canadian regulations. No regular boat and fire drill was carried out by the crew on the PETROLAB and no such drill was witnessed by the TC inspector at the annual inspection in May 1997. The TC inspector who inspected the vessel in May 1997 did not hold a petroleum tanker endorsement nor had he taken a petroleum tanker safety course. The vessel was inspected by the charterer, Ultramar Canada Inc., prior to hire in May 1997, but no inspection of the cargo-pumping equipment was carried out. The owner did not have a formal safety management system in place. There was no formal orientation/training policy for new employees. For at least 10 years , non-standard and unsafe work practices and procedures for tank washing and cargo slop storage had developed and come to be accepted. Only the first mate and chief engineer held petroleum tanker endorsements, which had been issued solely on the basis of the experience they had gained exclusively aboard the PETROLAB. The owner and first mate often left the master out of the decision-making process concerning ship's business and cargo handling. The owner and first mate made the decision to wash down cargo oil tanks (COTs), which had contained gasoline, with seawater delivered through a fire hose that was not grounded. The gasoline and water mixture (slops) was transferred using a portable pump that was not designed for this type of operation. The slops were being discharged into the cofferdam instead of into the dedicated slop tanks. The slops were allowed to free-fall into the cofferdam from an uncertified and ungrounded rubber hose, creating vapour concentrations in excess of the lower explosive limit (LEL) and a static electricity hazard. The exhaust fans for the cofferdam and 'tween-deck space were not running to ventilate these spaces. No atmospheric monitoring was conducted in the 'tween-deck, cofferdam, engine-room or COTs during the tank washing and slop transfer operations. The emergency escape door between the engine-room and the cofferdam was open during the transfer of slops. A small, non-standard submersible electric bilge pump was found in the forward engine-room bilge with its discharge hose leading toward the engine-room escape door. Engine-room bilge slops were present in the cofferdam. Much of the electrical equipment in the engine-room was not certified for use in a hazardous area and some wiring and fixtures were non-standard.While the precise source of ignition of the gasoline vapours created during the transfer of slops is unknown, the open engine-room escape door allowed the passage of either gasoline vapours or an explosion flame front from the cofferdam into the engine-room. None of the crew was wearing personal protective equipment such as fire-retardant clothing at the time of the explosion. The crew was unaware of the dangers associated with the cumulative carcinogenic effects of benzene in petroleum products. After the explosion, the ship's service generator stopped and there was no power to the vessel's fire pump. The vessel was not fitted with an international shore connection to charge her fire main from shore, and the ship's Scott air pack bottles were empty, after being used in the tank washing operations. After the explosion, the crew put out several small fires on deck with a portable fire extinguisher but the crew made no attempt to enter the engine-room to restart the generator to provide power to the fire pump before leaving the vessel. Fire wires were not rigged at the bow and stern of the vessel to enable the vessel to be towed clear of the wharf. Ultramar had no contingency plans in place for a major fire at the tanker loading berth; however, the action taken to flush the dock pipelines with seawater did prevent the spread of the fire to the tank farm, and possible pollution. Before the fire, Ultramar had not assessed the capability of the local fire department to fight shipboard--in particular, oil tanker--fires. The local fire department was not equipped with foam and had no training in fighting shipboard--in particular, oil tanker--fires. The fire departments did not bring the shipboard fire under control in its early stages, and burning paint on the vessel's outer hull spread the fire to the creosote-impregnated piles of the government wharf. The concrete deck on the government wharf limited the fire departments' access to the seat of the fire underneath, and the wharf was destroyed. The government wharf in St. Barbe was often used simultaneously by petroleum tankers conducting cargo operations and by the Quebec North Shore passenger ferry NORTHERN PRINCESS. The minimal precautions taken to separate ferry passengers from oil tanker hazardous cargo operations unnecessarily put the travelling public at risk. There has not been any evaluation of risks at regional and local ports handling petroleum products across Canada to prepare emergency plans. TC does not maintain physical or regulatory supervision over divested ports to ensure their compliance with existing safety provisions of acts and regulations. The UNEP/IMO has published guidelines to assist port officials in the preparation and application of emergency preparedness in port areas. 3.2 Causes The explosion occurred due to an accumulation of gasoline vapour in the after cofferdam, 'tween-deck space, and engine-room. The source of ignition was not determined. Factors contributing to the explosion were: the owner's and crew's ignorance of tanker safe working practices; the improvised and unsafe working practices devised to replace a tank-stripping system that had been inoperable for at least 10 years; the fact that there was no safety management system in place; the use of the cofferdam, which was open to both the 'tween-deck and engine-room, as a slop tank; the use of pumping equipment uncertified for use in a hazardous environment; the fact that the mechanical ventilation for the cofferdam and 'tween-deck area was not used and no atmospheric monitoring was carried out; and the presence of substandard electrical equipment and fittings in the engine-room. 4.0 Safety Action 4.1 Action Taken Following this occurrence, Transport Canada (TC) was apprised of several safety problems regarding the cargo-pumping system on the PETROLAB (TSB Marine Safety Advisories (MSA) Nos. 01/98, 02/98, 03/98 and 04/98). 4.1.1 Cargo-pumping Systems MSA No. 01/98 stressed the importance for tanker owners to maintain the operational integrity and the safe working condition of all sub-elements of a tanker cargo-pumping equipment and stripping system. The current regulations and present annual survey requirements do not cover the inspection of such items. TC Marine Safety indicated its intention to issue a Ship Safety Bulletin to remind tanker owners of the hazards associated with improper practices. With regard to a more comprehensive inspection program to verify the operational integrity of cargo-pumping systems on oil tankers, TC indicated that amendments to the inspection regulations would require consultation with vessel operators and other interested parties to ensure consistent application. 4.1.2 Petroleum Tanker Endorsements MSA No. 02/98 apprised TC of several unsafe work practices--such as tank washing with improper equipment and slop transfer into inadequate spaces--employed for many years on board the PETROLAB. Such practices were the result of crew members' insufficient awareness of the hazards inherent in tanker operations. Not all crew members held a petroleum tanker endorsement, and those who did had never taken a petroleum tanker safety course. Consequently, unsafe work practices were perpetuated and reinforced. The MSA indicated the need for TC to reassess its requirements for the issuance and renewal of petroleum tanker endorsements. Subsequently, TC indicated that as part of the Continued Proficiency Endorsement process a regulatory change is to be implemented requiring that all certificate holders re-validate their Tanker Certificates every five years. 4.1.3 Firefighting in Canadian Ports Following the fire on board the bulk carrier AMBASSADOR in the port of Belledune, N.B. (TSB Report No. M94M0057), the Board recommended that the Department of Transport conduct a special audit of firefighting facilities at Canadian ports and harbours under its jurisdiction to ensure that there is adequate year-round capability to contain shipboard fires. Subsequently, the Canadian Association of Fire Chiefs (CAFC), with the aid of TC circulated a short questionnaire to assess the firefighting capabilities of municipal fire departments responsible for fighting fires in Canadian ports. In February 1998, in light of preliminary information coming from the PETROLAB investigation, TC Marine Safety and the CAFC were requested (via TSB MSA No. 03/98) to expedite their safety audit and review of risks and contingency measures in Canadian ports and harbours that contain oil terminals and where the installations are more susceptible to catastrophic damage should a fire break out onboard a vessel at the dock. In July 1998 the CAFC received a limited response to the survey questionnaire and found the answers poor and relatively insignificant. Most of the municipal fire departments surveyed are not members of the CAFC and did not feel compelled to respond. However, the CAFC found that the survey provided enough information to raise concerns that the firefighting services available in municipalities with public ports may not be adequate to provide firefighting services in the event of a fire on board a vessel. The CAFC indicated that they are interested in working with TC to pursue research in this area. 4.1.4 Public Safety MSA No. 04/98 apprised TC of the potential risk to the public due to the simultaneous oil tanker and passenger vessel operations in small public harbours. TC recognized the risk and indicated that several precautionary measures are already in place, including the posting of no smoking signs, and the requirements to have an individual stand by the manifold and have fire extinguishers near the manifold during tanker cargo loading and unloading operations. In addition, TC indicated that harbour masters and wharfingers have sufficient authority to direct vessels and manage the site. 4.1.5 Transport Canada Inquiry Pursuant to section 504 of the Canada Shipping Act, the Minister of Transport has appointed a commissioner to conduct a regulatory inquiry into this accident. The inquiry has been temporarily adjourned.